Malleable software: Restoring user agency in a world of locked-down apps (2025)
inkandswitch.com151 points by evakhoury a day ago
151 points by evakhoury a day ago
I agree that the current state of software is quite rigid. There is no room for imperfection and often one opinion is seen as fixed the best.
I think the essence of the GPL is trying to solve this issue, the freedoms of that license is focused on keeping software as editable as possible. The idea of malleable software is not new but most "business/industry" software is still very rigid.
One of the more interesting realized concepts of malleable software are the freewheeling apps from Kartik Agaram (https://akkartik.name/freewheeling/). Additionally in my opinion the idea of malleable software is at the core of unix everything is a file and the plan 9 system.
This whole article is true and to the point but... reality is: most people still don't build their own setups: work, home - most of them follow a sh*tty software or decorate with Ikea. I think this applies only to a small group of users how will be willing to go extra mile and prompt their ideal interface for whatever they need to do.
The realization that "normal" people don't care and will never care was the saddest for me. There are so few people who care. We're essentially irrelevant in the grand scheme of things. We have no leverage.
When I was younger and I heard the saying along the lines of "struggling against the indifference of the universe" I didn't realize at the time it included people too.
Yeah. The indifference of the universe is perfectly manageable. It's the indifference of people that broke me... I'm starting to question every principle I've ever had.
This may sound misanthropic of me, but it has helped immensely for me to view all of humanity as insignificant. Maybe even an anomaly as far as the scale of the universe, or at least an extreme rarity, capable of building societies and machines with more power and influence than our brains and bodies ever evolved to handle.
Perhaps many of us are indifferent because that is our default, and there is no reason we were "meant to" survive this long. If the universe's age scaled down was the length of a human lifetime, we almost went extinct the day before yesterday[1].
Beyond at least that moment, we are very lucky to still be around. There is nothing about us that is special against the vast indifference of the universe. While we may feel special ourselves, against our own atomic understanding of our surroundings, we are not, and that gap could very well be a primary source of our suffering.
That said, it does not stop me from enjoying my time here in this beautiful place and, as Camus put it, raging against the absurdity.
1: https://www.scientificamerican.com/article/human-ancestors-n...
Life is complex. You probably don't optimize your life in a way that some other person would be shocked you're not doing.
And they probably optimize their life in a way that's invisible to you.
Different people care about different things (beyond near term well being). We have no ability to be deeply involved in million different topics, but most of us care about several. And random couple of people may have no intersection and could symmetrically see each other as a "useless normie".
That's, uhm, normal and why groups form by interests, from cooking to hiking to reading to hackerspaces to rocketry. I see it as neither bad nor sad. My 2c.
I understand that, I just don't like it.
Computers are world changing technology, magical runes we can bend to our will. I wanted people to care, to fully harness the power of these machines. But virtually nobody cares.
That wouldn't be a problem if this just came down to individual choice, but it doesn't. The fact they don't care has enormous impact on us who do care.
Because they don't care, we are a minority and therefore have no economic leverage. One day the big corporations will make computers that only they control. They will lock us all out. Nobody really cares, people will keep buying the locked down computers and will even defend it as a security feature as though the lockdown was for their own benefit. They could have been lords of their own digital domain, but it turns out they enjoy living as serfs in the digital fiefdoms of trillion dollar corporations.
We also can't have privacy and anonymity because of this. For anonymity to work, we need a massive anonymity set. We need lots of people using things like Tor, ideally most people if not all people. This is so that people can't tell us apart, but also so that they can't just blanket ban Tor traffic without serious economic consequences. But nobody cares, people are just fine with being spied on, so they don't use it and it weakens privacy for us who do care as well.
It's so sad, and I'm starting to actually blame these people for the sad state of things. I look at the trillionaire technocrats building this dystopian world and taking advantage of them, and I start to wonder if they were right to do so. People could have stopped this, if only they cared. They didn't... And therefore they deserve it.
How about this framing: no one person can care about everything but it's important that everyone care about something.
You pushing back on computing makes the digital world a little better for the Ikea designer who doesn't see the magic and just wants to make figure out if the pizza place is still open. In turn, that designer makes sure there's a decent baseline for the design of your home, even when you don't want to think about it. Together, you both make room for the urban planner or chef or nurse, even if you don't think much about transit or gastronomy or healthcare....
There is a mental load budget and when it runs out, people experience decision fatigue ( https://en.wikipedia.org/wiki/Decision_fatigue ).
When that is exhausted, people are more likely to take the simple decisions without thought.
Not having to make those decisions is a privilege. Not having to worry about food prices is one such example. Not having to worry about the healthiness or preparation of the food is another.
For many people, they're fighting with the lowest levels of their needs ( https://en.wikipedia.org/wiki/Maslow%27s_hierarchy_of_needs ) that the higher ones don't get much attention.
Even when one does have all the needs fulfilled and able to make decisions about things at the "self actualization - achieving potential and purpose" level, there are so many things out there that one can't make everything a personal utopia (even if they had all the resources to do so).
I'm ok with having an Ikea bed and shelving because I lack the skills and my financial priorities aren't in that direction to customize it myself. I'd love to have the perfect shelves for my game room... but Kallax is ok.
And while I've got the perfect computer setup for the things that I do... my kitchen is a mess that lets me cook the basic food things that I do. To a chef, my kitchen is dystopian. To a carpenter, my shelves are a corporate blandness. To me, their computers and digital workflows are poorly organized.
Not everyone has the capability to understand the nuances of digital security and make choices that improve (or at least don't make it worse) situation.
I can't care about all those things.
What can be done is try to contribute to a "raising tide that lifts all boats" and helps everyone more easily achieve their needs and allow others to be able to meet their potential so they can care about those things without being overwhelmed.
The minority of the population isn't "people who care about digital security" - it's "people who are able to act on realizing their potential." To say that the people who are still working on achieving their safety and physiological needs of housing and health and food and water don't "deserve it" because "if only they cared" are to blame for the world taking advantage of them and responsible for the sad state of things.
People need to be able to not worry about where their next meal comes from before they can be worried about using Tor for everything (or ensuring that people are eating healthy as a chef, or are living in houses that meet their needs as a carpenter).
What exactly are you sad about? You're only just realizing highly technical knowledge makes your opinions a minority?
DUH.
Guess what? That same knowledge gives you agency. With LLMs now, even more so. Want something? Build it (or have claude build it)
Why are you being a defeatist over something you can't control that was always the case? Nothing has changed.
I seriously encounter this hand-wringing on HN. You are pointing out a real problem in the world. A problem that, if not solved, will keep most of the people in the world helpless and at the mercy of governments, billionaires and the platforms they control.
But I don’t like to just bitch. I like to build. So then I show the free and battle tested software I built lovingly over a decade, that solves exactly this, and that I use in my own companies, but also give away for free
https://github.com/Qbix/Platform
What more can I do? I’m just some guy in Brooklyn, who never got funded by VCs (except Balaji’s fund) but persisted for over a decade and published nearly everything as open source for the benefit of others who might know how to deploy it. I keep sharing better and better versions over the years.
What initially surprised me over the years is that the result when I share all this for free on HN is… I get downvoted by other HNers who vehemently hate someone “self promoting” a solution to this very problem. They donmt just “not care”, they care very much that others on HN should not be exposed to such free and open source solutions
Having faced the same problem (of people not running their own servers), I went ahead and built an all-in-one server that you can use to create binaries, copy them, manage public web files like in redbean, as well as php files to run inside the server, then distribute those too. Took me months of iteration with Claude. When I posted it on HN got… 3 upvotes.
Then it was resurrected and reposted by the mods, got 40 upvotes, lots of snark about me having dared to use AI to build it, and “TL;DR” comments, and then… the post resurrected and reposted by the HN moderators themselves was… flagged:
https://news.ycombinator.com/item?id=49749789
In the days since, I have improved the server a lot and v2 even lets regular PHP script kiddies build a Jack-Dorsey-style app on iOS and Android. Many people on HN will immediately have a reaction: “why PHP, it’s so old”. So I updated the github to answer that:
https://github.com/Qbix/webserver
Again, this is MIT licensed, and open source. On Reddit, the situation was even worse. Lots of upvotes at first, then anyone saying nice things about it got heavily downvoted and various trolls started posting snarky comments. Oh well, at least it attracted 150 stars and some people are actually forking it and using it.
But let’s be real, not everyone wants to run a webserver. That’s why we had “commodity hosting” in the past. But how to make it so that people can “just use” software they can trust, without anyone being able to tamper with it? In 2017, I got enamored with Blockchain for that reason. I saw tens ofnthousands of people running nodes, and letting normies “just post” transactions. I saw a way that high-calue transactions and balances could be protected. I launched Intercoin Inc, raised half a million dollars (and more since), built the software, deployed it on 7+ EVM blockchains, and made it freely accessibls:
https://intercoin.org/applications:
https://www.sec.gov/Archives/edgar/data/1733567/000173356718...
Unlike most projects in 2018, we treated the fundraise like a security, and tried to do everything by the book. But, just sharing anything with the word “blockchain” in it should earn me the wrath and downvotes of a certain very active subset of HN. I feel like they almost see the word “blockchain” and insta downvote. Maybe these mechanisms are not even human? Who knows. It cost a lot of money to get right at the time, and released as free and open source. This is Hacker News. One would think they’d celebrate this, let others discover it and use it, even if they themselves don’t like web3. <— (there, I put that “keyword” in there, watch what happen to this comment now). But no.
But blockchain was expensive, slow, and couldn’t hold secrets. And that brings me to… my solution in 2026, which I spent over a year designing and building with AI:
https://safebots.ai/safebox.html
For now HN is split between AI fans and AI lamenters (I saw this arc in web3 too). So this should get a mixed reaction. Even though Safebox isn’t even only for AI. It’s a new security primitive, like blockchain itself was.
The key is this: normies don’t have to run it. You can run it, by cloning an EC2 instance, getting clients, and autonomously earning in safebux, which you can cash out on the… blockchains. Oh am I going to be downvoted now. There is nothing to configure, manage, etc. It is like running your own “commodity hosting”, except you never get to access client data, and you get paid through the decentralized system automatically, and clients get security, failover, etc.
There is much more to this, and soon you’ll hear more about it. But I expect to find - not just people “not caring” - but violent opposition from a very vocal and activist subset for some reason. I mean, I build it, refine it for a decade and give it away for free, for others to serve each other and make money. If you don’t want to, that’s fine, my company will run most of the servers (like Matt Mullenweg’s Wordpress.com did). Or you will be able to run some too, by just cloning an EC2 in your account on AWS, GCP, Azure, OCI, etc.
Once again, it’s not “most of the people out there”. Watch what happens right here on HN.
PS: Safebots + Safebox + Safebux is coming out in a couple months. Until then, I have released Safecloud for encrypted and decentralized storage, absolutely for free, and a alightly technical person can run a backend (Jet). And literally anyone can contribute storage and earn safebux by simply opening a tab and keeping it open. Or don’t earn safebux - the default is absolutely free, for everyone. Use it for some stakeholders or users of your own websites to contribute redundant storage. Or don’t. But at least maybe upvote to let others discover it? Anyway. Here are the links:
https://safebots.github.io/Safecloud/
Academic writeup: https://arxiv.org/abs/2606.09870
And initial coverage by security magazines:
https://www.helpnetsecurity.com/2026/06/19/safecloud-browser...
We're not just bitching. I've contributed to free and open source projects. I've reverse engineered my laptop and released Linux free software. I'm investing in local inference computers. I've even created my own programming language.
We're doing what we can. The point is it's not enough. One day they will lock us out either way.
The whole point is we can't create an open source computer fab. They cost billions of dollars. It's just not happening. We can make free software at home, but we can't make free computers in our garages. Unless we figure out a way to do this, it's pointless. The chip manufacturers will be the ones responsible for the end of our freedom.
FPGAs -at the cost of going back to 90s hardware performance- actually grant us the ability to make free computers in our garage. I’ve been using LLMs to design CPUs and SoCs and had decent success, actually. You’re still trusting Vivado, I guess, but there is work being done in open toolchains.
Running at 200Mhz rather than 4GHz though is hard to accept for most people, even though retro OSes make the experience quite smooth overall.
I’d argue stuff like the various bootrom exploits for Apple SoCs and similar, used for jailbreaking, is the other side of this. And that one gets you open computing at a much higher perf, although not necessarily malleable, and is not going to be a long term viable strategy.
I think one of the best ways of stopping lock-in is to be file-based. Obsidian is a good example of this. Users can just keep their data as is and move on with their lives.
Many people like email for a similar reason: Every message is an independent item that can be moved and copied at will, organized into folders, filtered and sorted, moved between accounts and email clients, attached to other messages, saved and loaded as files, and so on.
Intelligence and the mental load it requires has a budget - in both real and artificial forms. In real - people are bombarded with tools and requirements and when the teams behind those don’t consider mental load required, that spends down the budget. Thus people give up fighting all battles and are forced to prioritize their resources. Denial of service attack on the brain. AI models running out of context will do the same and get lazy. Sadly any bad actor private or government knows this and uses it as a tool to fight intelligent resistance to its plans.
I believe it is critical for regulators to force mega-corporations (and software vendors in general) to permit third party clients.
I use services like YouTube every day, why can I get sued if I write my own YouTube client that's better than the one provided by Google? Why can I get sued if I create a chat client that aggregates the myriad of chat services I use?
I'd argue that this even extends down the stack. Why is there only Android and iOS? It's because hardware drivers are practically impossible to write for undocumented hardware (which is virtually all hardware). Vendors should be compelled to document their hardware such that drives could be produced for them.
Asahi Linux is a testament to a team attempting the impossible and making unbelievable progress - but it's still not competitive with first party drivers.
I want a world where I can run Linux on my MacBook Pro and my phone. I want a world where I can flash a custom firmware to my TV that removes the bloat and spyware. I want a world where I can use the services I depend on in ways that are better than what the vendor can produce. I want a world where I can rebuild applications and games lost to time.
I have the skills and desire to do these things.
But nah. Not allowed.
Everything you listed is exactly the reason why copyleft and GPLv3 needs to be the first and foremost license when opensourcing. If proliferated, it can give you all of these freedoms listed that you (and i) desire.
> If proliferated, it can give you all of these freedoms listed that you (and i) desire.
Hold up, let's not oversell things here. GPL/Copyleft just means that you have to share source if you share binaries. However big companies exploit the digital commons differently now.
Instead they run the important pieces remotely in their data-centers, and release neither binary nor source. If they do a client binary (e.g. phone apps), they can just sprinkle in some naive encryption and some "copyrighted content" on the server. Then if you make a custom client--or even document how to do it--you might go to jail. [0]
> I want a world where ...
> I have the skills and desire to do these things.
Please check out my page on the topic https://fabien.benetou.fr/Content/SwappingPartsOfTheRestrict... and let me know if I could improve it somehow to help you.
Overall though my recommendation is :
- do what you can TODAY no matter how small
That means if the OS is too big a of a step, start with an application. If the hardware is too locked down, start with data so that next time you buy hardware, you will bring over that data then switch. Don't postpone.
> But nah. Not allowed.
Some of it, you are. At least for personal use. Our minds are our own jails here - we treat abstraction layers as more than suggestions, and vendor preferences as more than opinions. I recommend to try and challenge it.
https://news.ycombinator.com/item?id=49875994
LLMs, whatever you think of them, currently alter equation a lot when it comes to one-off work like this. I have the skills too (for some of these things), but I don't have time/energy/capacity to do the things necessary to bypass around the obstacles. LLMs do.
Maybe I'm uneducated here, but wouldn't this just commoditize the products of companies? Would it disincentivize them from creating their products in the first place?
YouTube's product is the commercials it targets with the collected user data, not the web or phone client. So as long as the client doesn't get in the way of showing these advertisements and collecting that user data, it should not matter to them.
In more general case, you don't pay for the client software (or web page), you pay for the service provided trough it, so it should not matter if you use the service trough different client.
Of curse, many of these new clients do provide options for getting around the data collection or make it possible to block the advertisement, and that makes the companies so strict about who makes clients and how.
In a sense, yes - intuitively, you'd think it's bad but historically it's actually a major accelerant to innovation.
Essentially, if competition entered the market, Apple (and co) aren't going to give up, they'd be forced to innovate in order to retain market share.
If individuals (like me, some random on the internet) were permitted to create competing services on top of hardware and software that exists, you'd be running SteamOS on your MacBook, you'd be plugging your phone into a USB-C dock or lapdock, you'd be able to export data from your health tracker so you can buy a new one and keep your existing data, etc.
By contrast, the status quo of permitting corporations to attain functional monopolies by making it practically impossible to compete is a far worse outcome for the general consumer.
Also, when you consider that the EU is looking at cutting their reliance on US technologies - they are literally not going to make a MacBook or iPhone in this decade - but if Europeans were allowed to install their own software on these devices, the road to sovereignty gets a whole lot less impractical
Also, as stated below, as long as you don't prevent YouTube (or similar) from making money from ads (ad blocking, etc) - there is no reason to not allow you do to this.
Did TV, VCR, soundbar, monitor, laptop manufacturers end up stop manufacturing their devices because they had to talk to each other with a compatible HDMI format? And the user could swap out the TV device that played media from Apple TV?
Where do you get those silly ideas?
I don't understand what you mean. Are you saying that products with open APIs are commoditized faster than ones without? Why would that be?
i think they meant the hardware becomes more fungible. This is what made IBM lose their competitive advantage when it came to PCs, because others were able to make IBM-compatible ones that are cheaper and still able to use the same old software.
Right. But viewed differently, that made everyone have to compete at actually making good PCs, instead of relying on customers unable to escape to another vendor due to lock-in.
We want this. Software and other modern tech desperately need this! How many companies are stuck with an absolutely terrible suite of MS products because you can't easily rip out and replace just the IM or videoconferencing part, for example?
Its good for the buyers, and good for broader society and the economy.
Its bad for vendors.
Why would vendors do something that is bad for them? HN is full for people talking about how to create a "moat" for their products. Why do you expect hardware vendors not to want to do the same?
> Why do you expect hardware vendors not to want to do the same?
of course they want the moat - the point is that society as a whole should force them not to have a moat. Ala, they should not be allowed monopolies.
Unfortunately, this sort of legislation has been lacking recently, and in fact, has been failing even enforcing existing ones from yester-century.
This is true about most businesses, hence the dissonance. Pretty much every time a business creates "a moat", it's bad for consumers in some way.
Except if the moat is something like "have managed to attract and retain stellar workers who make fantastic products with excellent durability and support at a reasonable price, resulting in such a happy customer base that any upstart will struggle to gain a foothold". The horror!